Technology Or Education? Tackling Phishing Requires Both

Cybercriminals typically steal data using a triad of techniques–malware, hacking, and tampering with hardware.

The arguably more serious espionage attacks aimed at robbing companies of their intellectual property, however, have a slightly different triumvirate of threats, dropping the physical theft of hardware in favor of socially engineering the human side of the business, according to Verizon’s 2013 Data Breach Investigations Report. In fact, 95 percent of all state-affiliated espionage attacks include a phishing component, the report’s review of 47,000 data-security incidents found.

For companies, the data highlights a weakness in their network security: Even with near-ubiquitous anti-spam technologies guarding most inboxes, spearphishing attacks get delivered. And that puts the workers on the front lines, because every user could be put in a position of defending, or infecting, the business’s network, says Trevor Hawthorn, chief technology officer of phishing-awareness service provider ThreatSim.

SOURCE: darkreading.com